DPA case 128/2023 – Complaint Upheld (Belgium, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A real estate agent ignored a person's request to know where their data came from and to erase it. The Belgian Data Protection Authority ordered the agent to comply with the person's requests for data access and deletion. This case shows that businesses must respond to data requests promptly and correctly.
What happened
The real estate agent failed to respond to a person's request for information about their data source and to erase their data.
Who was affected
The person who requested information and erasure of their personal data from the real estate agent.
What the authority found
The Data Protection Authority found that the agent breached GDPR rules by not fulfilling the person's requests for data access and deletion.
Why this matters
This ruling reinforces the obligation for businesses to respond to data requests in a timely manner. Companies should review their processes for handling such requests to avoid penalties.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On 10 June 2023, the data subject received an email from a real estate agent (the controller). On the same day, the data subject replied to this email requesting explicilty for the controller to notify him of (a) the person or company who transmitted his data, and (b) requested that all of the data related to him be erased. The controller did not respond to the data subject. The controller claimed to have received the data subject's information from a source they knew but refused to disclose, and instead stressed that every email included the option to opt-out. On 2 August 2023, the data subject filed a complaint with the Belgian DPA. The DPA made an order under Article 58(2)(c) for the controller to comply with the data subject's requests under Article 15(1) GDPR and Article 17(1) GDPR. Firstly, Article 15(1) GDPR provides data subjects with the right to access personal data concerning them and infromation relating to it, from a controller In particular, Article 15(1)(g) provides that a data subject is entitled to information concerning the source of data "where personal data are not collected form the data subject..." Secondly, Article 17(1) GDPR establishes the right of erasure, which grants data subjects the right to request that all data concerning them are erased by the controller. Lastly, the DPA concluded a prima facie breach of Article 15 GDPR and Article 17 GDPR in combination with Article 12(3) GDPR and Article 12(4) GDPR, because the controller did not facilitate the request for data access and erasure. Article 12(3) GDPR provides a time limit of 1 month for controllers to facilitate requests made under Articles 15 - 22 GDPR, and Article 12(4) GDPR notes that if the controller does not take action within the prescribed time frame, they must inform the data subject of why they did not take action and the data subject's ability to lodge a complaint with a supervisory authority. The controller did neither, thus the
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 128/2023 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 128/2023 - Belgium (2023). Retrieved from cookiefines.eu
Last updated: